Black Box, Phishing, and Vishing Testing for an Investment Advisor

Summary

A US financial advisor firm offering retirement account services wanted to ensure the maximum security of its clients' data and evaluate its employees' cybersecurity awareness. In two weeks, INNERLUXES performed black-box penetration testing of the firm's retirement-planning solution — web application, API, and public network — alongside phishing and vishing simulations, surfacing medium- and low-severity vulnerabilities with pragmatic fixes and recommending security-awareness training based on the social engineering results.

About the Client

The Client is a US financial advisor firm offering retirement account services. Its web application helps clients invest and manage retirement savings plans.

The need for expertise in IT security and investment software

To ensure the maximum security of its clients' data, the Client was looking for an experienced cybersecurity vendor with hands-on background in investment software. The Client found the required competence with INNERLUXES and engaged us to examine its retirement-planning solution and evaluate its employees' cybersecurity awareness.

Real-world attack simulation to verify cyber resilience

Black-box penetration testing

INNERLUXES's experts performed black-box pentesting of the Client's retirement-planning solution according to the PTES, OWASP Web Security Testing Guide, and NIST 800-115 methodologies. The testing area included a customer-facing web application, an API, and a public network comprising 5 IP addresses.

Our pentesters scanned the targets for known vulnerabilities and validated the findings to eliminate false positives. To evaluate the potential impact of the identified gaps, INNERLUXES's team attempted to exploit the vulnerabilities by simulating a real-life cyberattack.

During the pentesting, INNERLUXES revealed three medium-severity and seven low-severity vulnerabilities, classified based on the OWASP Top 10, OWASP API Top 10, and NIST CVSS. The detected weaknesses could be exploited by an attacker to steal sensitive data, distribute malware, and affect web server performance. To seal the gaps, our pentesters suggested pragmatic corrective measures, such as:

• Implementing strict input validation and sanitization to prevent injection attacks.
• Replacing FTP with a more secure file transfer protocol like SSH to take advantage of built-in encryption.
• Introducing brute-force protection: using SSH keys and disabling password authentication where possible, configuring the firewall to allow connections to remote hosts only from selected IPs, adding CAPTCHA, enforcing a limit on failed login attempts, and blocking an account or IP when the limit is reached.
• Updating vulnerable software to its latest version to prevent memory corruption and remote execution of attacker-controlled code.
• Preventing malicious cross-domain requests by properly configuring the Access-Control-Allow-Origin header and setting up server-side protection of sensitive data (e.g., authentication and session management).
• Configuring the missing HTTP headers, such as X-Frame-Options to improve protection against clickjacking, Strict-Transport-Security to enforce protection against man-in-the-middle attacks by only using HTTPS, and X-Rate-Limit to mitigate the risk of attackers overwhelming the system with too many requests.

Phishing and vishing simulation

INNERLUXES's team ran several social engineering scenarios against 25 employee emails and 2 corporate phone numbers. During the phishing attack simulation, most employees followed safety precautions and ignored emails with unknown links. However, 2 of the 25 employees submitted their personal data in a Google Form controlled by INNERLUXES's pentesters. For the vishing simulation, our experts attempted to call at different hours but received no response.

Based on the social engineering testing results, INNERLUXES recommended organizing security awareness training for the Client's employees.

Insights into cybersecurity risks and ways to reduce them

• In two weeks, INNERLUXES conducted black-box pentesting and simulated phishing and vishing attacks.
• The Client received a report detailing the detected vulnerabilities and associated risks to its IT infrastructure and client data, along with remediation recommendations that helped the company quickly fortify the cyber defense of its retirement-planning solution.
• Satisfied with the assessment results, the Client plans to engage INNERLUXES in future security testing projects.

Technologies and Tools

Acunetix, Metasploit, Nessus, Hydra, SSLScan, Nikto, Burp Suite, Nmap, DirB, WhatWeb, Python, C, Perl.